Many folks here have PMed me about security policy writing. I figured I'd answer in a public arena so that everyone can benefit.

Here are tw RFCs that are great places to begin your adventure:

http://www.cis.ohio-state.edu/cgi-bin/rfc/rfc2196.html
http://rfc.sunsite.dk/rfc/rfc2504.html

Look these over and you should have a good idea of how to begin and how to tighten your policies.

Hoe this helps!

--TH13